Gmail exploit

[bhj 24]

 

Philipp Lenssen spotted a post by Brandon at GeekCondition that explains the general idea behind an attack that can be used to set up filters in your Gmail account without your knowledge. It’s important to be aware of these kind of things so you can better protect yourself.

 

In order for this to work, someone has to first steal your Gmail cookie — bad guys are always looking for new ways to do this, and according to Brandon, there is at least one (but probably several) outstanding methods that can be used to get your cookie.

 

As long as you practice safe browsing techniques, the risk of your Gmail account being compromised is significantly lower. Here are some things you can do to protect yourself.

 

1. When you aren’t using your Gmail, log out. Staying logged in is handy, but it makes these kind of attacks possible.

2. Don’t visit websites you don’t trust. That sounds pretty obvious, but it’s just as important as making sure your Gmail account is logged out when you’re not using it.

3. Use NoScript if your browser is Firefox. This adds an additional (and very powerful) layer of security between you and the bad guys. There’s nothing similar for Internet Explorer or Google Chrome that I’m aware of.

 

It’s important to note that these problems aren’t limited to Gmail — any website that uses cookies to authenticate requests can be taken advantage of the same way. Taking the security measures above will help protect all your online accounts too.

[tomi 0]

Oh nice!!

 

I use noscrpit and follow all the "orders" too. Seems trust-worth and safe.

 

Ahh and NoScript is cool!!

 

P.S. Btw gmail has knew skin, eh?

 

 

Got to take a try! Nice find, and thanks!

Edited November 24, 2008 by tomi

[bhj 24]

P.S. Btw gmail has knew skin, eh?

 

yep I saw

 

[1Razor 0]

First post since joining!

 

Wanted to say thanks for the heads up on NoScript, looks very good on first impressions. I also have Flashblock installed which helps speed up page downloads also. It just gives a small block instead of running flash anims immediately, so if you want to see the anim just click on it!

[gogoblender 3,071]

First post since joining!

 

Wanted to say thanks for the heads up on NoScript, looks very good on first impressions. I also have Flashblock installed which helps speed up page downloads also. It just gives a small block instead of running flash anims immediately, so if you want to see the anim just click on it!

 

 

Welcome to DarkMatters, 1Razor!

 

I'm super careful actually with both gmail and msn mail. I know they're hot for hackers, and I try as often as I can to not stay logged into the accounts if not using them. Alas...so convenient to keep 'em open

 

 

gogo

[Arafinwe 0]

Welcome to DarkMatters, 1Razor!

 

I'm super careful actually with both gmail and msn mail. I know they're hot for hackers, and I try as often as I can to not stay logged into the accounts if not using them. Alas...so convenient to keep 'em open

 

 

gogo

 

 

Indeed it is convenient, and since I use Webmail notifier I have to stay logged in for it to work.

But like Tomi I use NoScript, and also R.I.P, Better Privacy 1.22 and goolash. (Funny name that

one for a extension. )

[1Razor 0]

I'm lucky in that not many people mail me so I don't have to keep Thunderbird open all the time, less chance for any problems